Windows Wi-Fi Driver EUVD-2026-99959

Exploitation requires the attacker to be on an adjacent network - within Wi-Fi radio range of the target or able to inject frames the target's Wi-Fi driver will process (e.g., same wireless LAN, shared hotspot, or rogue AP) - reflecting the AV:A vector rather than remote internet reachability. The target must have the Windows Wi-Fi driver active (wireless adapter enabled and processing frames). No authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L). The primary limiting factors are physical/radio proximity and the requirement that Wi-Fi be in use; impact is confined to availability (system/driver crash), with no data exposure or code execution.

This is a moderate-severity denial-of-service issue, not a top-tier priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.5) shows an adjacent-network, low-complexity, unauthenticated, no-interaction attack whose ONLY impact is availability (C:N/I:N/A:H) - i.e., a crash/DoS, with no data compromise. The signals are consistent and point AWAY from urgency: CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public proof-of-concept identified in the provided data, so there is no evidence of active exploitation. The AV:A (adjacent) vector is a meaningful limiter - an attacker must be within Wi-Fi radio range rather than exploiting across the internet - which bounds the practical blast radius despite the lack of required privileges or user interaction. CONFLICT TO NOTE: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the CVSS vector explicitly sets C:N (no confidentiality impact) and the CWE is CWE-125 (out-of-bounds read) producing a DoS - the tags overstate the impact and should not drive prioritization. Net: a real but low-urgency patch item, prioritized by the ubiquity of Windows rather than by exploitation likelihood.

An attacker within Wi-Fi radio range of a target (e.g., sharing a corporate wireless LAN, public hotspot, or operating a rogue access point) transmits specially crafted or malformed Wi-Fi frames that the Windows Wi-Fi driver mishandles, triggering an out-of-bounds read. This causes the driver or system to crash, denying service to the affected host. No public exploit code is identified at time of analysis, and no authentication or user interaction is required (PR:N/UI:N), but proximity (AV:A) is mandatory.